I created ~/pki-demo/www/index.html and started a simple server with:
python3 -m http.server 8000 --directory ./www
The page loads at http://localhost:8000/.
In Wireshark, I captured on the loopback interface (lo0) and filtered with tcp.port == 8000. I opened the HTTP stream from the context menu.
304 Not Modified because the browser sent If-Modified-Since. A 304 carries only headers, so there is no response body to read.
I forced a fresh request with a hard reload or by running curl -v http://localhost:8000/. The server responded with 200 OK, and the HTML body appeared in plain text.
HTTP traffic is readable. An eavesdropper can see request paths, headers, and page contents.
Public certificate authorities validate control of public DNS names. localhost, 127.0.0.1, and ::1 are local addresses. They are not eligible for public certificates, so a self-signed certificate is used and then trusted locally.
I ran the HTTPS server on port 8443, captured on lo0, and applied tcp.port == 8443. The packet list shows the handshake and encrypted data.
TLS encrypts the HTTP conversation. Observers can see metadata such as addresses, ports, and timing, but not the actual content.